Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to find out who deleted a specific file from a USB disk.

The disk is formatted as NTFS. The file was deleted while the disk was plugged into a Windows 7 system. However, while I do have possession of the USB disk, I do not have access to that system anymore.

Using forensic techniques, with the presumption that no data was written over the deleted file, is it possible for me to determine who deleted it? Does this change, if there was newer data written over the file or if the culprit attempted to cover his tracks in any way?

share|improve this question
2  
Who, probably not. When, quite possibly (and this might lead to who by cross-checking with login session history). What operating system, what filesystem on the disk, has the disk been used since then, is there reason to suspect the deleter tried to hide his tracks? –  Gilles Jan 8 '13 at 15:17
    
why are you trying to determine who deleted the file? whats the context of your investigation? –  Matthew Jan 8 '13 at 15:40
2  
Let me make sure I have the scenario right. You have a USB disk, formatted as NTFS. Someone plugged that disk into a Windows 7 system, and deleted some file(s) from the USB disk. You are now in possession of the USB disk, but do not have access to the Windows 7 system. You want to know who deleted the file. If all of the preceding presumptions are correct, I doubt you'll be able to find your answer without re-gaining access to the Windows 7 system. Even then, depending on the system's auditing configuration and user authentication mechanisms, your chances might not be so great. –  Iszi Jan 8 '13 at 18:52
    
NOTE: I'm going to roll up all the data from comments into the question. Please re-edit if it is inaccurate. –  Iszi Jan 8 '13 at 18:56
    
Yeap that sums it up pretty much Iszi. MP: I am trying to determine who deleted an important file from a USB disk because there was no backup at the time. I know the machine was win 7 for the stick was in the company all the time but not the specific computer. –  Athanasios Kataras Jan 8 '13 at 19:20

1 Answer 1

up vote 3 down vote accepted

No, there is no way to know who deleted the file by looking at the USB stick alone. Even if there was a way it would be very easy to modify the content of the USB stick to mask this behavior. If you have access to the machine then you can configure windows to log file deletion events. However, even windows log files can be modified.

share|improve this answer
    
Answer accepted but please explain why - Is this because the usb drive itself has no logging information about the user? So the only way to find it is to pinpoint the exact pc and hope logging is enabled. Thank you very much. –  Athanasios Kataras Jan 9 '13 at 8:02
    
@Thanos K. well NTFS doesn't log this type of information, this file system is about saving space wherever possible. Most people don't care about this level of logging, they care about more storage. –  Rook Jan 9 '13 at 15:36
    
@Rook you mention that NTFS does not log this, could you name a fs that keeps track of the access? I am trying to discover what a device is looking for when I connect a usb stick to it, and read the device's "fingerprint" –  olamotte Dec 13 '13 at 16:27
    
@olamotte This is not the role of a filesystem, but an application can use a filesystem to perform this action. –  Rook Dec 13 '13 at 17:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.